Description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.
Published: 2026-09-10
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via crash when receiving a malformed UPDATE with an empty AS_PATH attribute
Action: Apply Patch
AI Analysis

Impact

GoBGP is an open source Border Gateway Protocol implementation written in Go. Prior to version 4.7.0 the software accepts a zero‑length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer because it accesses the first element of the AS_PATH without bounds checking. This flaw causes a denial of service when a confederation eBGP peer receives a malformed UPDATE with an empty AS_PATH attribute, resulting in a process crash.

Affected Systems

The affected product is osrg:gobgp. All releases older than 4.7.0 are vulnerable; releases 4.7.0 and newer contain the fix.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. The EPSS score is less than 1%, showing a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector involves a remote BGP session where an adversary injects a malformed UPDATE packet containing an empty AS_PATH attribute to a confederation eBGP peer, leading to a crash. The flaw is an unchecked array index access (CWE-125) and unchecked bounds checking (CWE-129).

Generated by OpenCVE AI on September 21, 2026 at 05:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GoBGP to version 4.7.0 or later.
  • If an upgrade is not immediately possible, configure eBGP peers or use BGP policy filtering to discard UPDATE messages that contain an empty AS_PATH attribute before they reach the GoBGP process.
  • Apply firewall or access‑control rules to block or drop malformed BGP UPDATE packets with an empty AS_PATH from untrusted peers.

Generated by OpenCVE AI on September 21, 2026 at 05:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-frrj-87jh-2772 GoBGP confederation validation panics on empty AS_PATH attribute
History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 11 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Osrg
Osrg gobgp
Vendors & Products Osrg
Osrg gobgp

Thu, 10 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.
Title GoBGP confederation validation panics on empty AS_PATH attribute
Weaknesses CWE-129
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Osrg Gobgp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-11T20:31:16.420Z

Reserved: 2026-06-01T18:50:36.056Z

Link: CVE-2026-49838

cve-icon Vulnrichment

Updated: 2026-09-11T16:31:57.039Z

cve-icon NVD

Status : Deferred

Published: 2026-09-10T22:16:57.660

Modified: 2026-09-16T13:42:46.970

Link: CVE-2026-49838

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-10T21:57:15Z

Links: CVE-2026-49838 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T06:00:09Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-129

    Improper Validation of Array Index